Complete procedures with a way back.

Build a tagged Ubuntu Tailscale router, advertise and approve a private subnet, authorize users with least-privilege grants, test optional internet egress, and rehearse failure, withdrawal, and replacement.

Deploy or repair an OpenVPN 2.6 gateway with certificate checks intact. Start Cannot resolve host address with the client's pre-tunnel DNS and actual profile; investigate VERIFY ERROR, peer certificate verification failure and TLS handshake failed only at their demonstrated transport or TLS layer.

Create a minimal routed WireGuard VPN with protected keys, explicit peers, constrained forwarding, and peer removal.